1

The processing of Group Policy failed. Windows attempted to read the file \XXXXXXX.com\sysvol\XXXXX.com\Policies{XXX-XXX-XXXX}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

I know the reason it can’t read that file is because there is security filtering on that GPO to exclude the GPO from applying to the logged on user.

However, why can’t it get past that GPO and apply all the others instead of completely failing gpupdate?

A new, unrelated GPO has been applied that does apply the this computer, but it won’t apply because of the error with the filtered GPO.

10 Spice ups
2

What is the policy doing?

This might be of help: Group Policy Order of Precedence FAQ | Me, Myself and IT

3

“gpt.ini” is not a policy - and security filtering should not cause processing to stop for other policies.

See this thread - Unable to read the gpt.ini from a domain controller

IMHO, the best advice from there is:

In general, this problem is caused by one of the following:

1. SYSVOL replication is broken and the GPO’s contents in SYSVOL are not replicated to every DC

2. The GPO is truly corrupt in SYSVOL and missing one or more key files

3. The client can’t resolve the DFS path to SYSVOL. I’ve seen this caused by disabling the “TCP/IP NetBIOS Helper” service, so I would check that.

4. If it’s per-computer policy that is generating this message, it could be a network stack timing issue as the machine starts up. You can tweak the client’s policy at Computer Configuration\Admin Templates\System\Group Policy\Specify startup policy processing wait time.

Also, just note, the Default Domain Policy can be “restored”. Microsoft provides the DCGPOFix.exe tool ( http://technet.microsoft.com/en-us/library/hh875588.aspx ) that lets you reset the DDP and DDCP GPOs to their default settings, if these GPOs are truly corrupt. In the case of these tools, you would have to recreate any settings that you had in these GPOs.

1 Spice up
4

The GUID in the error matched the GUID for a GPO that is filtered from the logged in user via a deny ACL on the GPO.

When I logged into the system with the local administrator account instead of a domain account, I was able to run gpupdate successfully and then the new group policies applied to the PC, but that’s a poor solution that doesn’t scale.

5

Then are we talking multiple users getting the error? How about trying a new profile for that user?

6

I only see this issue one user now, but I’ve seen it before with other users.

Maybe changing the deny read permissions on the GPO just deny apply group policy will prevent this issue.

1 Spice up